Quantum-ready key management: preparing PKI infrastructure for quantum computers by 2026

Quantum computers capable of running Shor’s algorithm could threaten RSA and elliptic-curve cryptography. Organisations need to prepare their key-management systems (KMS) for post-quantum cryptography. The transition affects certificate governance, threat modelling and regulation, and needs to be planned before 2026.

Introduction: PKI on the brink of the quantum era

In 2022, the National Institute of Standards and Technology (NIST) published the first standardised post-quantum encryption algorithms — CRYSTALS-KYBER for public-key encryption, CRYSTALS-KD for key exchange, as well as Dilithium and Falcon for digital signatures [1]. Their adoption marks the end of an era where RSA (2048 bits) and ECDSA (P-256) were considered computationally secure against classical computers.

At the same time, the private sector and public laboratories are announcing rapid advances in quantum computing: IBM presented a 433-qubit processor in 2023, and Google demonstrated an improvement in noise factor (quantum volume) to 128 [2]. Although the capacity required to break RSA-2048 is still estimated at between 4,000 and 20,000 logical qubits — remaining out of reach for now —, projections from several institutes (ENISA, ANSSI) converge towards a critical window of opportunity before 2030 [3][4].

For companies whose certificate lifespans span five to ten years, the 'latency period' between the issuance of a certificate and its expiration creates a risk of retroactive compromise. An attacker capturing an RSA-2048 public key today will be able to decrypt all past communications protected by that key as soon as quantum computers become capable.

Why 2026?

• NIST Timeline: the first version of 'NIST Special Publication 800-208 – Recommendation for Key Management' already incorporates PQC migration requirements and anticipates an official update by the end of 2025 [5].
• European Roadmap: the EU's 'Quantum-Safe Cryptography' plan sets 2026 as the target date for critical public services to have adopted at least one post-quantum algorithm within their PKI [6].
• Commercial Solution Maturity: since 2023, several providers (Thales, Entrust, DigiCert) have offered PQC-compatible HSM and KMS modules, available in 'hybrid' versions from 2024.

These milestones require CIOs, CISOs, and data governance officers to begin a progressive transformation of their PKI infrastructures immediately.

1. The quantum threat model applied to PKI

The threat model is therefore evolving: traditional cryptanalysis (factoring, discrete logarithm) is giving way to quantum cryptanalysis. The exposure surface is increasing because post-quantum algorithms are not yet universally deployed and heterogeneous systems (hybrid RSA + Kyber) introduce new interfaces.

2. Technical principles of post-quantum solutions for key management

2.1 Public key encryption algorithms (KEM)

• CRYSTALS-KYBER – lattice-based, it offers reasonable public key (~800 bytes) and private key (~2400 bytes) sizes, with security equivalent to RSA-3072.
• NTRUEncrypt – a lattice-based alternative, already implemented in OpenSSL 3.0 (module provider).

These KEMs replace RSA-Encryption or ECDH within the TLS 1.3 protocol and PKI key exchanges.

2.2 Digital Signature Algorithms

• CRYSTALS-Dilithium – medium-sized signatures (~3000 bytes) with performance comparable to ECDSA.
• Falcon – more compact signatures (≈660 bytes) but higher computational requirements, suitable for constrained devices.

CAs must sign certificates using these algorithms to ensure post-quantum integrity.

2.3 Hybrid Approach

The hybrid mode combines a classical algorithm and a PQC algorithm within the same operation: the client encrypts a symmetric key using both RSA (or ECDH) and Kyber, then sends both encrypted blocks. The server decrypts both, retaining only the one that succeeds. This technique ensures service continuity as long as one of the algorithms remains invulnerable [7].

2.4 Key Storage and Protection

HSMs (Hardware Security Modules) must be updated to support new key sizes and cryptographic primitives. Vendors have released compatible firmware:

• Thales nCipher 4.x – supports Kyber-1024, Dilithium-3.
• Entrust nShield 2024 – addition of the pqc provider for OpenSSL.

The Key Management Interoperability Protocol (KMIP) 2.0 has integrated extension fields for PQC algorithms, facilitating standardisation between KMS and HSM.

3. Migration architecture: from traditional PKI to quantum-ready PKI

Read the diagram notation

graph LR
    A[CA principale] -->|Émission certif. RSA| B["RA (Registration Authority)"]
    A -->|Émission certif. PQC| C[CA post‑quantum]
    B --> D["HSM legacy (RSA/ECDSA)"]
    C --> E["HSM quantum‑ready (Kyber/Dilithium)"]
    subgraph KMS
        D
        E
    end
    F[Applications] -->|TLS hybride| G[Load Balancer]
    G --> A
    G --> C

• Creation of a post-quantum CA: a distinct authority that signs certificates using Dilithium or Falcon, while maintaining the same trust hierarchy (root, intermediates).
• Deployment of a quantum-ready HSM: firmware update or acquisition of a new module capable of generating and storing larger keys.
• Implementation of a hybrid gateway: the TLS server exposes two cryptographic suites (e.g., TLS_AES_256_GCM_SHA384 + Kyber1024) via ALPN negotiation. Compatible clients select the strongest suite, while legacy clients remain on RSA/ECDSA.
• Database synchronisation: the Certificate Management System (CMS) must simultaneously store classical and post-quantum algorithms within the same subjectPublicKeyInfo field. The X.509 format was extended in 2022 to accept PQC OIDs [8].
• Lifecycle management: each certificate has two expiry dates – a 'classical' one (5 years) and a 'post-quantum' one (10 years). Key rotation is performed in parallel to avoid service disruptions.

4. Use case: migration of a European bank to a quantum-ready PKI

Context – Bank X, a pan-European operator with over 30,000 TLS servers and a portfolio of RSA-2048 certificates with an average lifespan of 7 years. Management has set a target to reduce the risk of retrospective compromise to < 5% by 2026.

Lessons learned

• HSM capacity planning: post-quantum keys are up to 5 times larger than RSA; slot expansion must be anticipated.
• Legacy management: hybrid mode prevents a hard cut-off; however, some applications (e.g. IoT devices) do not yet support Kyber and require a conversion bridge.
• Governance: updating the Certificate Policy (CP) required involvement from the compliance committee (ANSSI, GDPR) to validate new OIDs.

5. Regulatory and normative challenges

These texts converge towards an obligation of due diligence rather than a strict prohibition: organisations must demonstrate that they have assessed quantum risk and implemented a documented migration plan.

6. Operational constraints and associated costs

On average, a large enterprise (≥ 10,000 servers) can expect a total investment between €2 and €4 million over five years, including HSM licences, consulting services, and training. This figure remains lower than the potential cost of a massive breach due to the retroactive compromise of a PKI (estimated > €10M according to ANSSI) [9].

7. Points of vigilance

Technical risks

• Flaws in PQC implementations: although standardised, some libraries (e.g. liboqs‑openssl) may contain bugs that weaken security.
• Future depreciation: the NIST standardisation process is still ongoing; some algorithms may be replaced or adjusted by 2028.

Organisational risks

• Fragmentation of the certified estate: if each department adopts its own PQC algorithm, centralised management becomes difficult and increases the risk of misconfiguration.
• Regulatory non-compliance: failure to update algorithm registries may lead to sanctions during a GDPR or ANSSI audit.

Trade-offs

• Hidden costs: migration often involves updates to CI/CD pipelines, regression testing, and adaptations to application code (e.g. Java Security Provider).
• Latency impact: hybrid TLS exchanges increase handshake time by approximately 10-15 ms, which can be critical for services with